Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

0
votes
0answers
40 views

Malware propagation to new drives [on hold]

I am studying the tactics of new versions of malware, but I would like to how malware writers perform their spread to other drives. I found that once it is executed, it looks for network/fixed drives, ...
13
votes
1answer
3k views

Should one buy new hardware after a system compromise?

If there are places on a laptop malicious programs can leave elements, hooks, backdoors etc, in locations such as BIOS, device controllers, firmware etc - what confidence can one have in wiping the ...
3
votes
1answer
84 views

When to use which rootkit?

I am new to information security and is currently studying about rootkits. According to my understanding so far: a kernel-space rootkits runs in ring0 and use techniques such as syscalls a user-...
1
vote
0answers
16 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
0
votes
1answer
136 views

How to inject a malware in a video

Is it possible to trigger an antivirus program to alarm by playing a video? I don't want to run malware, I only want the AV to do something. Can I put EICAR in the metadata? The video file shoudn't ...
1
vote
1answer
48 views

Executing vs Extracting PE32/PE32+ executable

If you have a malicious upon execution ("running" it / double clicking on it) .exe , would extracting its contents with something like 7-Zip utility mitigate its effects? Or can it still do harm?
2
votes
0answers
65 views

How this tracking (and more) was done using an image in an email?

As reported in the NY Times, there was some type of electronic spying in a high-profile military trial. Its claimed that the prosecutors were spying on the defense: The court-martial ... has been ...
-1
votes
0answers
70 views

create linux malware features data set

I am currently working on a project that requires detecting Linux malware through dynamic features (memory, CPU, IO, etc). I can't find a data set on other sites with the features I want, so as a last ...
0
votes
1answer
68 views

Is there a software that would scan the ports automatically, then predict if there are any malicious activity going on, on my Win10 PC? [closed]

I've got this malware(or spyware as Kaspersky detected), from the USB storage device by purely a lack of focus. After scanning and defecting all the drives that are connected to my computer with ...
0
votes
0answers
15 views

WMI ActiveScriptEventConsumer Creation Datec

So recently I've been trying to solve a ctf. I was able to determine WMI persistence mechanism is used with the aid of ActiveScriptEventConsumer& EventFilter classes. I believe finding the ...
0
votes
0answers
36 views

Protect LUKS encrypted HDD against boot sector key stealing attack

I have HDD with GPT, 1 MiB BIOS boot partition and LUKS encrypted volume group with data. When I boot the computer, GRUB asks for passphrase. However, I want to run some untrusted application which ...
-1
votes
1answer
69 views

Can a rootkit hide its data in slack space of pages in memory instead of disk?

So I'm asking about Linux or Windows type of rootkit/malware is this possible? can a rootkit use the slack space in the pages of the memory instead of disk to hide data? if so, has this ever been ...
0
votes
2answers
99 views

Notepad++ updater had no tittle or info. Is this okay?

While updating Notepad++, the updater window showed no title or information. Is this okay from security point of view ?
-4
votes
1answer
62 views

After have all the Patches, NotPetya can still run? [closed]

NotPetya runs inmediatly after infection or can be there and being executed even do i have all the security patches?
1
vote
1answer
111 views

How are malware able to start on boot on windows without administrator rights? [closed]

I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
33
votes
4answers
9k views

What is more safe for browsing the web: PC or smartphone?

The scenario is: somebody without concern about security is navigating through the web. This person will access doubtful websites, like adult content or media sharing, for example. Between a pc with ...
0
votes
1answer
51 views

Can a rootkit write to a virtual memory of a kernel process and rewrite a instruction to jump into his own malicious code inside that process?

So lets say we have a rootkit on our system can this rootkit write something inside a kernel process? for example in windows, can a rootkit write to ntoskrnl process, changing some functions and ...
-2
votes
2answers
85 views

Antivirus and malware fingerprints

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known ...
0
votes
0answers
35 views

I think I might be infected with some sort of remote access malware/keylogger and victim to hacker attack [duplicate]

I've learned about computers over the years but it hasn't been until recently where I really sat down and tried to learn about malware in-depth (like the registry and embedding in files, etc.). I've ...
0
votes
0answers
47 views

Detecting cracked Themida packed malware

I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples. As alluring as it is to suggest just blacklisting all Themida ...
0
votes
1answer
86 views

What are the heuristic detection techniques most often used in modern AVs? [closed]

Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: "it can be either static or dynamic", "it may use emulation", "may ...
0
votes
2answers
76 views

ML approach to malicious attachments using email contents

Based on my understanding of the field, it seems like there is a lot of attention paid to spam filtering based on the contents and metadata of an email, and there is considerable attention paid to ...
7
votes
2answers
146 views

What is the safest and most convenient way to transfer data from my computer to “unknown” USB devices?

I recently attended a friends wedding. As a gift to the couple I filmed lots of things and edited the clips into a montage of the big day. Thankfully they loved it and I have had requests from a ...
0
votes
1answer
54 views

How do AV vendors select malware signatures?

AVs use signatures to identify malware which are often strings of bytes or regular expressions thought to be unique to that malware. Do reverse engineers select these signatures by hand or do they use ...
2
votes
3answers
161 views

Is fileless malware is a new type of attack or the media just bringing them now more to our attention to promote sales of related “new” solutions?

I feel there are so many articles talking about fileless malware, so I was trying to understand is it a new type of attack or those articles are just kind of promoting new cyber solutions?
0
votes
1answer
62 views

What is Passive DNS Replication?

I use Virus Total for Malware Research, and I saw that it has a field called: "Passive DNS Replication", but I do not exactly understand what that means.I searched in VT blog, and they said that it is ...
0
votes
2answers
117 views

What would be a secure way to accept potentially infected files?

If I'm designing a web application that allows people to upload files to scan them for vulnerabilities do I need to worry about the server that accepts the files being infected/corrupted if a ...
0
votes
0answers
85 views

Is this a Malicious request?

I noticed there were over 550 malicious request rejected by the wordpress firewall but only this was accepted with HTTP 200 OK. This is the URL http://domainname.com//wp-admin/admin-post.php?...
0
votes
1answer
63 views

Is it possible to securely run user defined python code in AWS?

I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
5
votes
2answers
206 views

What are some examples of viruses/exploits with benevolent purposes?

A comment from another user had me thinking. What are some well-known (or perhaps not quite so) examples of in-the-wild "malicious" software that do nothing actually malicious, but instead takes ...
2
votes
1answer
99 views

Antivirus recall and precision not accuracy [closed]

I am studying antiviruses how antiviruses work at my university. This is just the very basics. He asked in our opinion which we think is better: recall or precision. Why does my professor say he ...
0
votes
1answer
102 views

How can I explain our system admins that AV can't protect our enterprise machines from attacks leverage on USBninja? [closed]

Was hoping to get your support to help to explain to our system admins how come the AV can't protect our enterprise from attacks that can be generated from USBninja. How can I explain our system ...
0
votes
1answer
106 views

Is VM escape has the same severity as me getting in a car crash? [closed]

I'm exploring the threats for VDIs on VMware, based on the article it seems the risk for VM escape has low severity as described here:http://vmescape.com/index.html Did we forget the discussion of ...
2
votes
1answer
156 views

How can I open a malicious image in whatsapp safely?

I have got an image send by whatsapp on my android tabled, which I only can see when I press the download icon. How can I see the image, without getting a virus when the image is malicious? Are ...
1
vote
1answer
68 views

What notable examples of metamorphic engines are there? [closed]

I am doing a research project on metamorphic malware and would like to have access to a metamorphic engine I could demo. Are there any good open-source (or easily obtainable) metamorphic engines I ...
0
votes
1answer
95 views

What can a compromised firmware (UEFI) do after the hard-disk has been wiped?

I might be mistaken, but it seems the firmware (UEFI) needs to load some stuff from the disk to be able to do anything really interesting, like loading some advanced tools or loading the OS. Yet ...
0
votes
1answer
87 views

Tools for reverse engineering malicious executables? [closed]

Are there any tools that one can reliably use for decompiling malicious executables in order to understand the inner workings of the same? Or any other reliable tool/way to quickly derive the code?
1
vote
0answers
83 views

Exploit Development - Bad chars

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ? The only explaination i could think of is that, in the case of a buffer overflow,...
1
vote
0answers
44 views

Invocation of a trusted NodeJS script tries to connect to unkown IP

I have a houskeeping script which I invoked using node index.js which got me this output The error is because you cannot connect to the IP, but why would it try to connect to it in the first place? ...
94
votes
9answers
21k views

Can a virus destroy the BIOS of a modern computer?

In the late 1990s, a computer virus known as CIH began infecting some computers. Its payload, when triggered, overwrote system information and destroyed the computer's BIOS, essentially bricking ...
0
votes
0answers
61 views

How to spot malwares that hide their disk usage from Resource monitor?

So lets say a malware has hid itself from task manager, so it wont show up in there. lets also say that it also hides its disk usage from resource monitor as well. (based on previously asked ...
3
votes
1answer
141 views

Are there any known viruses/malware that can infect Ubuntu that come from the USB?

I know that most viruses that can infect the OS from having an infected USB inserted into the PC are mostly Windows only, but is there any possibility that there is one that can affect Ubuntu as well?
0
votes
0answers
175 views

Can my father's smartphone be compromised?

My father said to me that he allowed installation of apps from unknown sources when he was asked to do it to go further with something (he said that don't remember when or what he was doing). In ...
4
votes
2answers
188 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
0
votes
0answers
43 views

Why should we use antivirus scanning on our NAS?

When using non-persistent VDI windows instances that running AV but the storage is on NAS, should we also install AV on the NAS to do real-time scanning or it's good enough that we have AV running on ...
0
votes
0answers
27 views

How to cleanse Wordpress of Japanese SEO hack [duplicate]

Our results on SERPs indicate that we are victim of a possible SEO hack, as all descriptions & titles are returned in Japanese. Desperate for some assistance in removing this problem, would ...
0
votes
1answer
88 views

Is it safer to use Qubes with Whonix from Virtualbox than directly on the host computer?

I know it isn't advised to run Qubes-Whonix from Virtualbox due to performance issues, but other than that, is it safer? I.e. is it harder or easier to hack/infect Qubes-Whonix running from Virtualbox ...
43
votes
8answers
7k views

Is it ever safe to open a suspicious HTML file (e.g. email attachment)?

If I receive an email that has an attachment called something like safe-link.html would it ever be safe to open this file? Clearly, HTML files may have malicious scripts embedded that could run when ...
0
votes
1answer
126 views

Strange spam to my IG and email with my secret information

I got strange email recently telling that i have an affair and it listed my visited cities with my boyfriend last year. Also threaten to share my relationship with others. Something that bother me ...
0
votes
0answers
18 views

How to investigate and remove Trojan:EC2/DGADomainRequest.B [duplicate]

My GuardDuty management console on Amazon shows that my server is infected with malware: "EC2 instance i-7e1d4356 is querying algorithmically generated domains. Such domains are commonly used by ...